mport is the MidnightBSD Package Manager. Prior to 2.7.8, doactualinstall() in libmport/bundlereadinstallpkg.c used path-based lstat(), chown(), stat(), and chmod() operations while installing package files. A local attacker with write access to a target directory could replace a checked file with a symlink before privileged ownership or mode changes were applied, redirecting those changes to an attacker-selected path and compromising filesystem integrity or permissions. This issue is fixed in version 2.7.8.

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSETDIR or ASSETDIROWNERMODE in libmport/bundlereadinstallpkg.c used path-based mportmkdirp(), ownership, and permission operations. A local attacker able to modify part of the target installation tree could use dot-dot traversal or substitute symlinks during privileged package installation, causing directory creation or attribute changes to affect attacker-selected paths outside the intended package directories. This issue is fixed in version 2.7.8.

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex() function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or compromised mirror able to alter bootstrap index content or its transport path could therefore cause mport to proceed with an unverified or tampered bootstrap package index. This issue is fixed in version 2.7.8.

On 6/10/26 15:19, bumsrakete wrote: Affected versions

Vulnerable (verified or by inspection): - FreeBSD 13.0, 13.1, 13.2, 13.3, 13.4 - FreeBSD 14.0, 14.1, 14.2 - FreeBSD 15.0-RELEASE (verified on 15.0-RELEASE-p5/amd64) This would also impact MidnightBSD 4.0+

Lucas

In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel. During binary interaction, td->tdemuldata in sys/compat/linux/linuxemul.h is not getting initialized and returns NULL from emfind().

A memory corruption vulnerability was found in the kernel function kerngetfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode.

The pftestrule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.

Integer signedness error in the fwioctl (FWIOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115, NetBSD-current before 20061116, NetBSD-4 before 20061203, and TrustedBSD, allows local users to read arbitrary memory contents via certain negative values of crombuf->len in an FWGCROM command. NOTE: this issue has been labeled as an integer overflow, but it is more like an integer signedness error.